KR20130093806A - System for notifying access of individual information and method thereof - Google Patents

Abstract

PURPOSE: A personal information leakage alarm system in cloud computing environment and a method designate a security level according to importance of a data file, manages data on a data basis, and thereby more effectively manages problems related to security of personal information. CONSTITUTION: A file registration unit (210) disperses/stores files into multiple chuck servers, and manages security level information of the file. A file search unit (220) receives a file access request from a client module, and confirms the security level information of the file corresponding to the file access request. In case the security level information of the file is above a pre-set level, the file search unit notifies an owner of the file of the file access request. [Reference numerals] (120) File management server; (210) File registration unit; (212) Parser; (214) File division unit; (216) Metadata generation unit; (220) File search unit; (222) Metadata search unit; (224) Security level confirmation unit; (226) Notification unit; (230) Metadata storage unit; (240) Log information storage unit; (250) User information storage unit

Description

System for notifying access of individual information and method

The present invention relates to a file management server and method for preventing misuse of personal-generated data and personal information in a distributed file system, which is one of the technologies for cloud computing.

In cloud computing environments where multiple servers are networked to provide IT resources as a variety of services, virtualization technology is often used to provide flexible resources. In cloud computing, virtualization refers to a technology that abstracts and hides physical computing resources to users or other systems through software, and separates and integrates the resources as desired. However, in such an environment using the virtualization technology, the user cannot know which server the user's information is stored on, and does not know when the user's file is accessed or by whom. This is the most disturbing factor in using cloud computing for users.

In data-driven cloud computing, which requires the processing of huge amounts of data, a system can be built by applying a distributed file system that distributes, stores, and manages data on numerous servers. Distributed file systems for cloud computing have many similarities to common distributed file systems, but they are designed to be deployed on low cost hardware, must be fault-tolerant, scalable, and redundant Consideration should be given to the stability of the system using methods such as storage.

In a related prior art document, published on March 24, 2011, a US patent entitled "System, method, and software for providing access control enforcement capabilities in cloud computing systems" and published number US 2011 / 0072487A1 There is a public publication.

The present invention provides a file management server and method for allowing a user to know whether a user's file is misused in a cloud environment so that the user can use it more safely.

According to an aspect, a file management server may receive a file access request from a file register and a client module that distributes and stores a file to a plurality of chunk servers, manages security level information of the file, and secures a file corresponding to the file access request. And checking the level information, and notifying the owner of the file that the file access request has been made when the security level information of the file is equal to or greater than a preset level.

According to another aspect of the present invention, a method of managing a file includes: when a file access request is received, checking the security level information of the file corresponding to the file access request, and requesting the file owner to the owner of the file when the security level information of the file is greater than or equal to a preset level. Notifying that there has been.

According to the present invention, data-centered management by designating security steps according to the importance of the data file can more effectively manage problems related to the security of personal information, which is a problem in cloud computing. It can also help users determine whether a file that requires security is being leaked or misused. In addition, it is possible to manage the file more efficiently by setting the security level of the data according to the importance of the file to inform the owner of the file that the file is accessed when important data is accessed.

1 is a view showing the structure of a personal information leakage notification system for maintaining the security of the file in a cloud computing environment according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating an example of a configuration of a file management server of FIG. 1.
3 is a diagram illustrating a configuration of a client module according to an embodiment of the present invention.
4 is a flowchart illustrating a file storing process for maintaining security of a file in a cloud computing environment according to an exemplary embodiment of the present invention.
5 is a flowchart illustrating a file reading process for securing a file in a cloud computing environment according to an exemplary embodiment of the present invention.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. In addition, the terms described below are defined in consideration of the functions of the present invention, and this may vary depending on the intention of the user, the operator, or the like. Therefore, the definition should be based on the contents throughout this specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have.

1 is a view showing the structure of a personal information leakage notification system for maintaining the security of the file in a cloud computing environment according to an embodiment of the present invention.

The personal information leakage notification system 100 includes a client module 110, a file management server 120, and a plurality of chunk servers 130-1 to 130-n.

The client module 110 may be used through various types of user terminals such as a smart phone, a mobile phone, a personal computer, and the like. Although there may be a plurality of client modules capable of distributing and storing files using the file management server 120 and the plurality of chunk servers 130-1 to 130-n, the description will be given based on the client module 110.

The file management server 120 is connected to the client module 110 and the plurality of chunk servers 130-1 through 130-n through a network. The plurality of chunk servers 130-1 to 130-n represents a group of cloud servers used for cloud computing.

The client module 110 transmits a file to be distributed and stored to the file management server 120. Here, the file may be various kinds of data that the user wants to store through the system and is distributed and stored by the file management server 120. When a file is saved through the file management server, the owner information of the file is also stored. At this time, the owner information of the file may be represented as information that can identify the owner, such as the owner ID (identifier). When a file is received (or uploaded) from the client module 110, the file management server 120 divides the received file into chunk units of a predetermined size and divides the plurality of chunks into a plurality of chunk servers ( 130-1 to 130-n). The file management server 120 manages a location where a plurality of chunks of one file are stored in the form of metadata.

On the other hand, when the file management server 120 receives an access request for a specific file from the client module 110, the location of the chunk servers (for example, chunks) in which the file requested to the client module 110 is distributed in chunks. Location information of the server # 1 (130-1), the chunk server # 2 (130-2) and the chunk server #n (130-n)) and the chunk identification information stored in the corresponding chunk servers. The client module 110 may use chunk server # 1 130-1, chunk server # 2 130-2, and chunk server # n 130-n using the file storage information provided by the file management server 120. And directly receive chunks corresponding to the chunk identification information from each chunk server # 1 130-1, the chunk server # 2 130-2, and the chunk server # n 130-n. The client module 110 receives and stores chunks from each chunk server # 1 130-1, the chunk server # 2 130-2, and the chunk server # n 130-n to be distributed and stored in chunk units. You can restore the file.

Alternatively, the file management server 120 may determine the location of the chunk servers in which the file requested by the client module 110 is distributed in chunks (eg, chunk server # 1 130-1 and chunk server # 2 ( 130-2) and the chunk identification information stored in the chunk server #n (130-n)) and the chunk identification information stored in the corresponding chunk servers, respectively. ) And the chunks received from the chunk server #n 130-n to combine to restore the distributed file and then transfer the restored file to the client module 110.

In addition, the file management server 120 may manage security level information of a file received for distributed storage from the client module 110. The security level of a file can be classified into a number of levels, for example, can be classified into 'up', 'mid' and 'low' levels. The security level of the file may be set by the client module 110 and transmitted to the file management server 120. Alternatively, the file management server 120 may analyze the file received from the client module 110 and assign a security level of the file.

When the file management server 120 receives the file access request from the client module 110, the file management server 120 checks the security level information of the file corresponding to the file access request. It can be notified that a file access request has been made. To this end, the file management server 120 may manage owner information of a file including contact information of the owner of the file.

Hereinafter, a description will be given focusing on the configuration for the security management of the file among the functions of the file management server 120.

2 is a diagram illustrating an example of a configuration of the file management server 120 of FIG. 1.

The file management server 120 may include a file register 210, a file searcher 220, a metadata storage 230, a log information storage 240, and a user information storage 250.

The file register 210 receives the file requested to be stored from the client module 110 and stores the file in a plurality of chunk servers 130-1 to 130-n. The file register 210 manages a security level for a file.

The file retrieval unit 220 receives a file access request from the client module 110, checks the security level information of the file corresponding to the file access request, and sends the file owner to the owner of the file when the security level information of the file is equal to or greater than a preset level. It may be configured to notify that there was a file access request. The client module 110 may transmit a request for access to a file uploaded by the client module 110 to the file management server 120 as well as a file uploaded to the file management server 120 by another client module of another user. .

The metadata storage unit 230 stores metadata of a file including a file ID, security level information about the received file, location information where the received file is distributed and stored, and owner information of the received file.

The log information storage unit 240 stores log information indicating access information of the file. The log information may include various information related to access of the file. The log information may include a moving path, a file access time, etc. of a file distributed and stored in the chunk servers 130-1 through 130-n by file access.

The user information storage unit 250 stores user information including contact information for each owner of the file. User information may include owner ID and contact information. The contact information may include the telephone number of the terminal (eg, mobile phone) of the owner of the file, the email address of the owner of the file, and the like.

Hereinafter, the configuration and operation of the file register 210 and the file search unit 220 will be described sequentially.

The file register 210 checks whether a security level is set for the file, and if the security level is not set, analyzes the file and checks whether a word corresponding to the security keyword is included to set the security level. You can manage the security level for the file. The file registration unit 210 may manage the security level set in the file if the security level is set in the file.

Referring to FIG. 2, the file register 210 may include a parser 212, a file divider 214, and a metadata generator 216.

If the security level is not set in the received file, the parser 212 of the file registration unit 210 parses the received file. The parser 212 may generate an analysis result indicating whether the security keyword is retrieved from the file when at least one preset security keyword is detected from the file. The preset security keyword may include at least one keyword indicating the importance of the file or the sensitivity to security. As a result of the analysis, when the security keyword is detected in the file, or when the sensitive keyword exists in the file more than a predetermined number, the parser 212 may set the security level of the file to 'high'. The number of security keywords for setting the security keyword and the security level may be set by a user of the client module 110 or an administrator of the file management server 120.

Thereafter, the parser 212 may transmit a parsing result for setting the security level of the received file to the metadata generator 216.

The file division unit 214 may set a security level for the file using the analysis result transmitted from the parser 212.

The file dividing unit 214 divides the file into chunks as described above, determines the location of the chunk server in which the plurality of divided chunks are to be stored, the security level information of the file, and the split information indicating the result of dividing the file. And information indicating the location of the chunk server where the divided chunk is to be stored, to the metadata generator 216.

The metadata generator 216 generates information related to the received file. That is, if the security level of the received file is set, the metadata is generated and the file division unit 214 generates the metadata as a result of dividing the file, the location of the chunk server where the divided chunk is stored, and the like as metadata. To store and manage the metadata storage 230. The split information may include information used for file restoration such as ID and size information of each chunk.

When the file access request is received, the file retrieval unit 220 retrieves metadata about the file requested by the file access request from the metadata storage unit 230 and uses the retrieved metadata to secure a file. Check. The file search unit 220 may check the security level information of the file corresponding to the file access request from the metadata storage unit 230 whenever the file access request is received from the client module 110.

When the security level information of the file for which access is requested is equal to or greater than a preset level, the file search unit 220 searches the user information storage unit 250 and notifies the owner of the file that the file access request has been made. The file retrieval unit 220 may notify the owner of the file that a file access request has been made, such as by a text message or an email.

If the security level information of the file is not greater than or equal to a predetermined level, the file search unit 220 stores access information about the file as log information. When the file search unit 240 receives a log information access request from the client module 110 and the user of the client module 110 is identified as the owner of the file, the file search unit 240 searches for the log information storage unit 240 to access the log. The information may be retrieved and transmitted to the client module 110.

To this end, the file search unit 220 may include a metadata search unit 222, a security level checking unit 224, and a notification unit 226.

When a request for access to a specific file is received from the client module 110, the security level checking unit 224 searches for the metadata storage unit 230 by the metadata retrieval unit 222, so that the metadata for the file for which access is requested is received. Control to retrieve data. The metadata retrieval unit 222 retrieves the metadata of the file for which access is requested, and transfers the retrieved metadata to the security level checking unit 224.

The security level checking unit 224 checks the security level of the file for which access is requested from the retrieved metadata. The security level checking unit 224 may control the notification unit 226 to notify the owner of the file that there is a request for access to the file, when the security level of the requested file is equal to or greater than a preset level.

The notification unit 226 retrieves the owner information of the file from the user information storage unit 250 and notifies the owner of the file that the access to the file will occur using the retrieved user information. The user information of the file may include contact information such as the owner ID, the owner's mobile number and email information, and the notification unit 226 may send a message to the owner's mobile number of the file or indicate that there is access to the file. The file owner's email can be notified.

If the security level of the file for which access is requested is not greater than or equal to a preset level, the security level checking unit 224 may record and store the information as log information so that the owner of the file may inquire such contents in the future. The log information is log information related to file data, not information for monitoring an operating system or the state of the system.

The file management server 120 of FIG. 2 illustrates a configuration for managing the distributed storage of a file received from the client module 110, managing the security level of the file, and maintaining the security of the file. The file management server 120 May be configured to further include other functional modules.

3 is a diagram illustrating a configuration of a client module according to an embodiment of the present invention.

The client module 110 may include a control unit 310, a communication unit 320, a user input unit 330, and a display unit 340.

The controller 310 may control operations of the communication unit 320, the user input unit 330, and the display unit 340 of the client module 110. The controller 310 may perform a function for reading and writing a general file and setting a security level for the file. The controller 310 includes a security level setting unit 312 for setting a security level according to a user input signal. For example, the security level setting unit 312 provides a user interface screen for setting a security level for a file through the display unit 350 and for setting a security level input through the user input unit 330. You can set the security level specified according to the input signal. The security level setting unit 312 may receive a user interface screen for setting the security level from the file management server 120 and provide the same through the display unit 350. The communication unit 320 performs communication with the file management server 120 and the plurality of chunk servers 130-1 to 130-n. The communicator 320 may transfer a file having a security level set to the file management server 120.

The user input unit 330 receives a user input signal and transmits it to the controller 310. The user input unit 330 may be configured as a keypad, a touch pad, or a touch screen.

The display unit 340 is a display device that displays the information processing result of the controller 310. The client module 110 may include an additional module for performing various functions in addition to the configuration shown in FIG. 3.

4 is a flowchart illustrating a file storing process for maintaining security of a file in a cloud computing environment according to an exemplary embodiment of the present invention.

The file management server 120 receives a file requested to be stored from the client module 110 (410).

The file management server 120 checks whether the security level is specified in the file received from the client module 110 (420).

If a security level is assigned to the received file (420), the file management server 120 distributes and stores the file to the plurality of chunk servers (440). The file management server 120 may determine a distributed storage location of the file, generate and store metadata including a security level of the file and a distributed storage location, and distribute and store the file in the determined distributed storage location.

If a security level is not specified in the received file, the file management server 120 analyzes the file and assigns a security level (430). For example, the file management server 120 checks whether a predetermined security keyword is included in the file requested to be stored, and sets the security level information of the file to 'high' when the predetermined security keyword is included in the file. Can be.

Next, the file management server 120 may distribute and store the file in a plurality of chunk servers (440). In addition, the file management server 120 may generate, store, and manage metadata of a file including security level information about the received file, location information where the received file is distributed and stored, and owner information of the received file. .

5 is a flowchart illustrating a file reading process for securing a file in a cloud computing environment according to an exemplary embodiment of the present invention.

If a file access request is received with a security level of the received file (510), the file management server 120 searches for metadata of the file corresponding to the file access request and checks the security level information of the file (520).

If the security level information of the file is greater than or equal to a preset level (530), the file management server 120 may notify the owner of the file that there has been a file access request (540). In operation 550, a log thereof may be stored and managed.

If the security level information of the file is not greater than or equal to a preset level (530), the file management server 120 may record and store access information on the file as log information (550). Thereafter, when a log information access request is received from the client module 110 used by the owner of the file, the log information access request may be retrieved and transmitted to the client module 110.

According to the present invention, by managing the transaction for the deposit and withdrawal in the bank account, the user can manage the genealogy for important data owned by the user, such as the account holder can look up the details of the deposit and withdrawal, etc. By providing a system that lets you know if your data has been accessed, you can rely on the data stored in your cloud computing environment. In addition, the owner can be immediately notified when sensitive data is accessed, such as sending an SMS to a mobile phone whenever a user's card is used. In addition, the security level can be specified automatically by parsing the file to be saved based on the key security keywords already defined.

One aspect of the present invention may be embodied as computer readable code on a computer readable recording medium. The code and code segments implementing the above program can be easily deduced by a computer programmer in the field. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical disk, and the like. The computer-readable recording medium may also be distributed over a networked computer system and stored and executed in computer readable code in a distributed manner.

The above description is only one embodiment of the present invention, and those skilled in the art may implement the present invention in a modified form without departing from the essential characteristics of the present invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be construed to include various embodiments within the scope of the claims.

Claims (16)

A file register for distributing and storing files in a plurality of chunk servers and managing security level information of the files; And
Receiving a file access request from a client module, checking the security level information of the file corresponding to the file access request, and notifying the owner of the file that the file access request has been made if the security level information of the file is equal to or greater than a preset level; File management server; characterized in that it comprises a. The method of claim 1,
The file registration unit checks whether a security level is set for a file, and if the security level is not set, analyzes the file and assigns a security level according to whether a word corresponding to a preset security keyword is included. File management server, characterized in that for generating and managing metadata containing the security level for the file. The method of claim 1,
And the file registration unit generates and manages metadata including a security level set in the file, if a security level is set in the file. The method of claim 1,
And a metadata storage unit configured to store metadata of a file including security level information of the received file, location information of the received file distributedly, and owner information of the received file. server. 5. The method of claim 4,
When the file access request for a specific file is received, the file search unit searches for metadata about the file requested by the file access request from the metadata storage unit, and uses the searched metadata to set a security level of the file. File management server, characterized in that the check. The method of claim 1,
Further comprising a user information storage for storing contact information for the owner of the file,
The file search unit retrieves contact information for the owner of the file from the user information storage unit when the security level information of the file for which access is requested is equal to or greater than a preset level, and accesses a file to the owner of the file using the contact information. And notify that the request has been made. The method according to claim 6,
And when the security level information of the file is not greater than or equal to a preset level, the file retrieval unit stores access information about the file as log information. The method of claim 7, wherein
And a log information storage unit for storing the log information.
When the log information access request is received from the client module, the file search unit searches for log information of the access request file from the log information storage unit and transmits the searched log information to the client module. The method of claim 5,
The file retrieval unit checks the security level information of the file corresponding to the file access request from the metadata storage unit whenever the file access request is received from the client module. The method according to claim 6,
And the contact information for the owner of the file includes the telephone number and email information of the owner's terminal. When the file access request is received, confirming security level information of a file corresponding to the file access request; And
And notifying the owner of the file that a file access request has been made, when the security level information of the file is equal to or greater than a preset level. 12. The method of claim 11,
Managing the security level of a file received from the client module. The method of claim 12,
Managing the security level of the file received from the client module,
Checking whether a security level is specified in a file received from the client module;
If a security level is not specified in the received file, analyzing the file and assigning a security level;
Determining a distributed storage location of the file;
Generating and storing metadata including a security level of the file and a distributed storage location; And
And distributing the file to the determined distributed storage location. The method of claim 13,
Analyzing the received file to confirm owner information of the received file; wherein the metadata further comprises owner information of the file. The method of claim 13,
Analyzing the file and assigning a security level
Checking whether a predetermined security keyword is included in the file; And
When the predetermined security keyword is included in the file, setting the security level information of the file to a security level required to notify the owner of the file when requesting access to the file. How to manage your files. The method of claim 12,
Managing the security level of the file received from the client module,
Checking whether a security level is specified in a file received from the client module;
If a security level is specified in the received file, determining a distributed storage location of the file;
Generating and storing metadata including a designated security level and distributed storage location of the file; And
And distributing the file to the determined distributed storage location.

Images